rsyslog conditional forwarding for remote logs

Question

I have a rsyslog Server which have the below settings,Where its getting all the remote Linux systems logs and network logs.

# cat /etc/rsyslog.conf 
$ModLoad imudp
$UDPServerRun 514
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$template noida-dc, "/scratch/rsyslog/%HOSTNAME%/messages.log"
authpriv.*   ?noida-dc
*.info,mail.none,authpriv.none,cron.none   ?noida-dc
$IncludeConfig /etc/rsyslog.d/*.conf

Whereas Linux system logs are log as they are storing into /scratch/rsyslog with their hostames by creating a directory with hostnames itself and then creating a message file within it, that's fine.

However, i want to segregate the network logs which basically creates a Folder by Month names like Jan Feb Mar and then creates a message.log as well but as network logs do not have hostnames it Just creating a dir based on the moth name and keeping the only one file into it thats messages.log, my wish is to have these network logs to a different Directory like /scratch/network .

Below is message format within the network log directory Dec

Dec  2 19:04:22 Dec 02 13:34:22.768 cisco-apic-1 %LOG_-3-SYSTEM_MSG

So, Is there a way to tell rsyslog if remote message contains Dec or Jan then must go to /scratch/network.

What i tried as Follows but not working.

$template mynets,"/scratch/network/%HOSTNAME%/messages.log"
if $fromhost contains 'cisco-apic-1' then -?mynets
& stop

&

$template mynets,"/scratch/network/%HOSTNAME%/messages.log"
if $fromhost startswith 'Dec' then -?mynets
& stop

Linux Distro is : Centos 6

Answer 1

I admit I do not fully understand what your intent is. Nevertheless, I may have a solution.

First of all, "Dec", "Jan", ... usually stem back to the syslog header if and only if it is traditional RFC3164 syslog. With newer systems you do not have that indication. Also, many systems violate the syslog standard and you may also not find these strings inside the message.

Assuming they are present, and further assuming they are in the syslog header: then they are NOT part of $msg or $fromhost. To make it smooth and easy, you can simply check $rawmsg, which is the message as it was seen on the wire. This is in unparsed form, and it is an inferior way to handle such things, but the good thing is it works without understanding the full theory.

So you could say:

$template mynets,"/scratch/network/%HOSTNAME%/messages.log"
if $rawmsg contains 'Dec ' then -?mynets
& stop

Note that I added at least a a space after 'Dec' because otherwise it would match anything containing that string (e.g. 'Decimal').

This probably works, but it depends on a number of things that you should not take for granted. A much better way is e.g. to check if $fromhost-ip is different from the local host. Or, even better, creating a dedicated ruleset for remote logs. But that's not up to the original questions, so let's leave that out.